1. Related Applications
The invention described herein is related to that described in U.S. application Ser. No. 840,965 filed Feb. 26, 1992, entitled "Personal Computer System With Security Features and Method" and to that described in U.S. patent application Ser. No. 07/889,325 filed May 22, 1992, entitled "Trusted Personal Computer System With Limited Accessibility," both of which are held in common ownership with this invention.
2. Field of the Invention
This invention relates to personal computer systems and, more particularly, to such a system having security features enabling control over access to data retained in such a system.
3. Description of the Prior Art
Personal computer systems in general and IBM personal computers in particular have attained widespread use for providing computer power to many segments of today's modern society. Personal computer systems can usually be defined as a desk top, floor standing, or portable microcomputer that consists of a system unit having a single system processor and associated volatile and non-volatile memory, a display monitor, a keyboard, one or more diskette drives, a fixed disk storage, and an optional printer. One of the distinguishing characteristics of these systems is the use of a motherboard (also known as and occasionally mentioned herein as a system board, system planar or planar) to electrically connect these components together. These systems are designed primarily to give independent computing power to a single user and are inexpensively priced for purchase by individuals or small businesses. Examples of such personal computer systems are IBM's PERSONAL COMPUTER AT and IBM's PERSONAL SYSTEM/2 Models 25, 30, 35, 40, L40SX, 50, 55, 57, 65, 70, 80, 90 and 95.
These systems can be classified into two general families. The first family, usually referred to as Family I Models, use a bus architecture exemplified by the IBM PERSONAL COMPUTER AT and other "IBM compatible" machines. The second family, referred to as Family II Models, use IBM's MICRO CHANNEL bus architecture exemplified by IBM's PERSONAL SYSTEM/2 Models 50 through 95. Early Family I models typically used the popular INTEL 8088 or 8086 microprocessor as the system processor. Certain later Family I and the Family II models typically use the high speed INTEL 80286, 80386, and 80486 microprocessors which can operate in a real mode to emulate the slower speed INTEL 8086 microprocessor or a protected mode which extends the addressing range from 1 megabyte to 4 Gigabytes for some models. In essence, the real mode feature of the 80286, 80386, and 80486 processors provides hardware compatibility with software written for the 8086 and 8088 microprocessors.
With the phenomenal growth and use of personal computers in the world in recent years, more and more data or information is being collected and retained or stored in such systems. A lot of this data is sensitive in nature. In the wrong hands, data could become embarrassing to individuals, a company could lose a competitive edge, or sensitive data could be used to force payment for silence or lead to physical violence against individuals. As more users recognize the sensitive nature of data and its value, the more it becomes desirable to protect against such misuse. To protect themselves and the persons associated with the stored data, users are requiring incorporation of security and integrity features into the personal computers that they purchase.
Users are not the only people to recognize the sensitivity of the data being collected and stored. Governments are also enacting laws to enforce protection of sensitive data. One such government is that of the United States. It has recognized and responded to the gravity of the situation. The United States federal government has defined security levels and the associated requirements it takes to meet those levels, and provides a certification agency for personal computer manufacturers to submit products, in order to see if the products meet the security level claimed by the manufacturer. The source for the Federal Requirements is the Department of Defense, Trusted Computer System Evaluation Criteria, DOD 5200.28 STD, 12/85, generally referred to as The Orange Book. The government has legislated that by Jan. 1, 1992 all data related to the government must only be processed and stored on personal computers with a minimum security level of C-2. For computer system hardware, the essence of the requirements is contained in the Assurance section, Requirement 6: "trusted mechanisms must be continuously protected against tampering and/or unauthorized changes . . . . "
Beginning with the earliest personal computer system of the Family I models, such as the IBM Personal Computer, it was recognized that software compatibility would be of utmost importance. In order to achieve this goal, an insulation layer of system resident code, also known as "firmware", was established between the hardware and software. This firmware provided an operational interface between a user's application program/operating system and the device to relieve the user of the concern about the characteristics of hardware devices. Eventually, the code developed into a Basic Input/Output System (BIOS), for allowing new devices to be added to the system, while insulating the application program from the peculiarities of the hardware. The importance of BIOS was immediately evident because it freed a device driver from depending on specific device hardware characteristics while providing the device driver with an intermediate interface to the device. Since BIOS was an integral part of the system and controlled the movement of data in and out of the system processor, it was resident on the system planar and was shipped to the user in a read only memory (ROM). For example, BIOS in the original IBM Personal Computer occupied 8K of ROM resident on the planar board.
As new models of the personal computer family were introduced, BIOS had to be updated and expanded to include new hardware and I/O devices. As could be expected, BIOS started to increase in memory size. For example, with the introduction of the IBM PERSONAL COMPUTER AT, BIOS grew to require 32K bytes of ROM.
Today, with the development of new technology, personal computer systems of the Family II models are growing even more sophisticated and are being made available to consumers more frequently. Since the technology is rapidly changing and new I/O devices are being added to the personal computer systems, modification to the BIOS has become a significant problem in the development cycle of the personal computer system.
For instance, with the introduction of the IBM Personal System/2 with Micro Channel architecture, a significantly new BIOS, known as advanced BIOS, or ABIOS, was developed. However, to maintain software compatibility, BIOS from the Family I models had to be included in the Family II models. The Family I BIOS became known as Compatibility BIOS or CBIOS. However, as previously explained with respect to the IBM PERSONAL COMPUTER AT, only 32K bytes of ROM were resident on the planar board. Fortunately, the system could be expanded to 96K bytes of ROM. Unfortunately, because of system constraints, this turned out to be the maximum capacity available for BIOS. Luckily, even with the addition of ABIOS, ABIOS and CBIOS could still squeeze into 96K of ROM. However, only a small percentage of the 96K ROM area remained available for expansion. It has been believed that, with the addition of future I/O devices, CBIOS and ABIOS will eventually run out of ROM space. Thus, new I/O technology will not be able to be easily integrated within CBIOS and ABIOS.
Due to these problems, plus the desire to make modifications in Family II BIOS as late as possible in the development cycle, it became necessary to offload portions of BIOS from the ROM. This was accomplished by storing portions of BIOS on a mass storage device such as a fixed disk, preferably in a defined portion of such a disk known as a system partition. The system partition also stores an image of a system reference diskette, which includes certain utility programs used in establishing system configuration and the like. Since a disk provides writing as well as reading capabilities, it became feasible to modify the actual BIOS code on the disk. The disk, while providing a fast and efficient way to store BIOS code, nevertheless greatly increased the probability of the BIOS code being corrupted. Since BIOS is an integral part of the operating system, a corrupt BIOS could lead to devastating results and in many cases to complete failure and non-operation of the system. Thus, it became quite apparent that a means for preventing unauthorized modification of the BIOS code on the fixed disk was highly desirable. This was the subject matter of U.S. patent application Ser. No. 07/398,820, filed Aug. 25, 1989, and now U.S. Pat. No. 5,022,077 issued 4 Jun. 1991. The interested reader is referred to that patent for additional information possibly helpful in understanding of the invention here disclosed, and the disclosure of that patent is hereby incorporated by reference into this specification to any extent necessary to a full understanding of the inventions here disclosed.
With the introduction of IBM's PS/2 Micro Channel Systems came the removal of switches and jumpers from I/O adapter cards and planar. The Micro Channel Architecture provided for programmable registers to replace them. Utilities to configure these programmable registers or programmable option select (POS) registers were required. These, and other utilities to improve system usability characteristics along with system diagnostics, were shipped with each system on a system reference diskette.
Prior to initial use, each Micro Channel System requires that its POS registers be initialized. For example, if the system is booted with a new I/O card, or a slot change for an I/O card, a configuration error is generated and the system boot up procedure halts. The user is then prompted to load the system reference diskette and press the F1 key. A "Set Configuration Utility" can then be booted from the system reference diskette to configure the system. The Set Configuration Utility will prompt the user for the desired action. If the appropriate I/O card's descriptor files are loaded on the system reference diskette, the Set Configuration Utility will generate the correct POS or configuration data in non-volatile storage. The descriptor file contains configuration information to interface the card to the system.
The related application Ser. No. 840,965 describes a personal computer providing means for limiting access to certain critical data to only those users having a proper privilege to access such data. In realizing this purpose, a specialized memory element is provided for receiving and storing a Power On Password and a Privileged Access Password (sometimes hereinafter called a "POP" and a "PAP" respectively) and for coordinating the access granted to various functions and data to the activation and usage of the passwords. A user may have choices to activate or inactivate the security provisions made available, so that the system can be adapted to varying needs or desires for securing the usage of the system. The system may be adapted to the security requirements of governmental standards if desired and yet also used in an essentially unsecured manner should the circumstances of use so permit. Thus users of such systems are given great flexibility in application of the systems. The teachings of this related Application are described in detail hereinafter in view of its relationship with the invention of the present Application.